Static task
static1
Behavioral task
behavioral1
Sample
ac1fd288d967c28bef76177dca8396215484f9a0bd9221272cf15cd5ca04f20d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ac1fd288d967c28bef76177dca8396215484f9a0bd9221272cf15cd5ca04f20d.exe
Resource
win10v2004-20220901-en
General
-
Target
ac1fd288d967c28bef76177dca8396215484f9a0bd9221272cf15cd5ca04f20d
-
Size
209KB
-
MD5
614b2e4fbe3537cf7393d40c84e3ce59
-
SHA1
630fe1d549bcac69ab1f7033d65c4f06c97ed13f
-
SHA256
ac1fd288d967c28bef76177dca8396215484f9a0bd9221272cf15cd5ca04f20d
-
SHA512
5a10c027fddf1031edd45e4f66a70ae28f8afa04fd3ebd61ac668d7c52dea790373974b2cae6ff128bd716c69b40114793393ea96159ede14b0db6b37f971f5c
-
SSDEEP
6144:fqmfmqqDLe0jlYhejQO92RAxemxRsbdvGzIZ/o7BE76K5cct1kWk:fqmfDqne0jlYUwW/s5Gzc/gYxc41kWk
Malware Config
Signatures
Files
-
ac1fd288d967c28bef76177dca8396215484f9a0bd9221272cf15cd5ca04f20d.exe windows x86
4669ea28d46f3db21d252b5a332073b7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
GetEnvironmentVariableW
FileTimeToDosDateTime
GetTempFileNameW
HeapReAlloc
CreateMutexW
FindFirstFileW
SetEndOfFile
HeapAlloc
SystemTimeToFileTime
GetCurrentProcess
SetFilePointerEx
GetLogicalDriveStringsW
HeapFree
GetProcessHeap
SetFileTime
VirtualQueryEx
OpenProcess
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
lstrcpynW
Thread32Next
GetTimeZoneInformation
DuplicateHandle
lstrlenW
GetTempPathW
GetFileSizeEx
OpenMutexW
LoadLibraryA
VirtualAllocEx
FindClose
Process32FirstW
RemoveDirectoryW
QueryDosDeviceW
Process32NextW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
CreateRemoteThread
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TerminateProcess
OpenEventW
GetFileAttributesExW
WaitForMultipleObjects
CreateEventW
GetVersionExW
VirtualFreeEx
VirtualFree
GetComputerNameW
SetErrorMode
GetCommandLineW
IsBadReadPtr
SetThreadPriority
GetCurrentThread
ResetEvent
CreateThread
GetLocalTime
GetLastError
GetSystemTime
GetNativeSystemInfo
GetProcessId
VirtualAlloc
SetThreadContext
GetThreadContext
WriteProcessMemory
VirtualProtectEx
GetCurrentProcessId
GlobalUnlock
GlobalLock
ExpandEnvironmentStringsW
LocalFree
CreatePipe
ExitThread
ReadFile
SetHandleInformation
CreateProcessW
GetUserDefaultUILanguage
GetModuleFileNameW
MoveFileExW
ReleaseMutex
GetCurrentThreadId
SetLastError
GetTickCount
SetFileAttributesW
lstrcmpiW
GetModuleHandleW
WTSGetActiveConsoleSessionId
lstrcmpiA
Sleep
LoadLibraryW
SetEvent
WaitForSingleObject
CreateDirectoryW
FreeLibrary
ExitProcess
CloseHandle
EnterCriticalSection
GetProcAddress
GetPrivateProfileIntW
FlushFileBuffers
CreateFileW
GetFileAttributesW
LeaveCriticalSection
InitializeCriticalSection
WriteFile
GetPrivateProfileStringW
MultiByteToWideChar
user32
CallWindowProcA
CallWindowProcW
DefWindowProcW
DefFrameProcW
RegisterClassA
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerA
ReleaseDC
CharUpperW
SetWindowLongW
GetWindow
RegisterClassW
GetDC
CharLowerW
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
DefDlgProcW
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
ExitWindowsEx
MessageBoxA
GetKeyboardLayoutList
DefMDIChildProcA
DefDlgProcA
SwitchDesktop
GetSystemMetrics
MapVirtualKeyW
FillRect
DrawEdge
IntersectRect
EqualRect
PrintWindow
DrawIcon
GetIconInfo
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
PostThreadMessageW
HiliteMenuItem
EndMenu
EndPaint
GetShellWindow
GetUpdateRgn
RegisterClassExA
DispatchMessageW
GetWindowDC
TranslateMessage
GetKeyboardState
GetClipboardData
DefFrameProcA
OpenInputDesktop
BeginPaint
GetUpdateRect
RegisterClassExW
GetDCEx
ToUnicode
GetMessageA
GetWindowRect
GetMessageW
SetCapture
PostMessageW
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
GetWindowLongW
GetAncestor
PeekMessageW
PeekMessageA
SetWindowPos
GetCursorPos
SendMessageTimeoutW
DefWindowProcA
CloseDesktop
DefMDIChildProcW
IsWindow
ReleaseCapture
SendMessageW
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
IsRectEmpty
CharToOemW
CharLowerBuffA
advapi32
EqualSid
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
IsWellKnownSid
GetLengthSid
CreateProcessAsUserA
CreateProcessAsUserW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertSidToStringSidW
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData
InitiateSystemShutdownExW
RegCreateKeyW
RegEnumKeyW
RegQueryInfoKeyW
shlwapi
SHDeleteKeyW
PathQuoteSpacesW
PathIsURLW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
PathRemoveFileSpecW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRemoveBackslashW
StrStrIW
StrStrIA
PathRenameExtensionW
StrCmpNIW
shell32
ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW
secur32
GetUserNameExW
ole32
CoSetProxyBlanket
CoUninitialize
CLSIDFromString
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoCreateInstance
gdi32
GetDeviceCaps
CreateCompatibleBitmap
DeleteObject
GetDIBits
CreateDIBSection
CreateCompatibleDC
SelectObject
DeleteDC
RestoreDC
SaveDC
SetRectRgn
GdiFlush
SetViewportOrgEx
ws2_32
listen
send
closesocket
WSASetLastError
freeaddrinfo
socket
bind
recv
inet_addr
getpeername
recvfrom
WSASend
gethostbyname
WSAIoctl
connect
WSAEventSelect
getsockname
accept
sendto
setsockopt
shutdown
WSAGetLastError
select
getaddrinfo
WSAStartup
WSAAddressToStringW
crypt32
PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData
wininet
InternetCrackUrlA
HttpOpenRequestA
HttpAddRequestHeadersA
InternetOpenA
InternetQueryDataAvailable
InternetSetOptionA
InternetQueryOptionW
InternetQueryOptionA
HttpEndRequestW
HttpSendRequestA
HttpEndRequestA
InternetSetFilePointer
HttpOpenRequestW
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetSetStatusCallbackA
HttpSendRequestExW
InternetCloseHandle
HttpQueryInfoA
InternetConnectA
HttpSendRequestExA
oleaut32
SysFreeString
VariantInit
SysAllocString
VariantClear
netapi32
NetUserEnum
NetApiBufferFree
NetUserGetInfo
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
winmm
PlaySoundW
waveOutSetVolume
waveOutGetVolume
PlaySoundA
Sections
.text Size: 196KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ